The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's configuration includes the Bash tool in its allowed-tools list. While the instructions advise the agent to use only read-only commands and avoid file modifications, the availability of the tool provides a technical capability for command execution that could be exploited.
[PROMPT_INJECTION]: The skill processes external codebase content using Read, Grep, and Glob tools, creating a surface for indirect prompt injection where malicious instructions in a project's source code could attempt to influence the agent. Ingestion points: The skill reads codebase files via the Read, Grep, and Glob tools mentioned in SKILL.md. Boundary markers: The skill lacks explicit delimiters or instructions for the agent to ignore instructions embedded within the data it analyzes, relying solely on natural language notes to remain read-only. Capability inventory: The Bash shell tool is available for use. Sanitization: There is no mention of sanitizing, validating, or filtering the content retrieved from the codebase before processing it.

architecture-patterns